
METHOD AND DEVICE FOR MODEL RESOLUTION AND ITS USE FOR 
DETECTING ATTACKS AGAINST COMPUTER SYSTEMS 

The present invention relates to a method and device for model resolution and its use 
for detecting attacks against computer systems. 

Secure computer systems can be subject to attacks or attempts at fraudulent entry. In 
general, one tries to ward off these attacks by establishing log files, for example system log 
files or network log files, and by running scans on these files for detecting a malfunction or 
an intrusion. The systems that perform the auditing of log files generally rely on a 
complicated method that poses problems in the writing, and moreover, the resulting audit is 
difficult to read. Furthermore, when the intrusion occurs in several successive non- 
concomitant stages, the system may very well not detect it. In addition, the writing of the 
audit conditions is not very flexible, not very modifiable, and poses modularity problems. 
Thus, in most rule-based systems, it is necessary to describe the audit conditions in the form 
of programs describing the activation of rules conditioned by events; for example, in order to 
describe an audit condition that specifies a step A, followed a short time later by B, followed 
a short time later by c, it is necessary to describe queuing rules for step A, which if successful 
must activate queuing rules for step B, which if successful must activate queuing rules for 
step C. This way of writing the sequence A, B, C is tedious, and results in errors that are hard 
to detect with a simple reading. Furthermore, certain known systems require the log files to 
be scanned several times. 

One object of the invention is to offer a high-performance specification resolution 
method. 

This object is achieved through the fact that the high-performance specification 
resolution method comprises: 

a) a step for formulating the audit conditions one wishes to detect using specification 
formulas expressing fraudulent entry or attack patterns or even abnormal operations, this 
being non-limiting, to be verified by examining the records of the computer system's log file; 

b) a step for expanding formulas into subformulas; 

c) a step for scanning by an interpreter, which consists of generating, for each 
expanded formula in each record, Horn clauses to resolve in order to detect whether or not the 
formula is valid in this record, the Horn clauses expressing the implications resolvent of the 
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subformulas for each record scanned, in positive clauses, i.e. counting only a positive literal, 
and in non-positive clauses, i.e. counting at least one negative literal, which negative literals 

•r « 

form the negative part of the clause; 

d) a step for storing the positive Horn clauses in a stack of worked subformulas, and a 
step for storing, in a table comprising a representation, the implicating subformula(s) 
constituting the negative part of the clause and the link with the implicated subformula(s) 
constituting the positive part of the clause, and storing in a counter the number of formulas or 
subformulas present in the negative part of the clause for each implicated subformula; 

e) a step for resolving the table based on each positive clause encountered, so as to 
generate either an output file or an action of the computer system; 

f) a step for iterating steps b) through e) until the scanning of all the records in the log 
file is complete. 

Another object is to provide great flexibility. 

This object is achieved through the fact that the method uses a temporal logic for the 
formulation of the specification. 

According to another characteristic, the table is a matrix and is indexed in columns by 
the subscripts of the formulas appearing in the negative part of the Horn clauses, and the lines 
are the Horn clauses exactly. 

According to another characteristic, the table is preferably represented in the form of a 
sparse matrix, the columns being represented by means of chained lists and the lines 
remaining implicit. 

According to another characteristic, an optimization of the expansion of the formulas 
is obtained through a hash table in order to ensure that the same formula is not expanded 
more than once in each record. 

According to another characteristic, the log file is scanned only once from beginning 

to end. 

Another object is to offer a device that makes it possible to implement the method. 
This object is achieved through the fact that the high-performance specification 
resolution device comprises: 

- an adapting means for translating the information from the log file formulated in the 
specific language of the machine into a language comprehensible to an interpreting means; 

- the interpreting means receiving the information from the adapter and receiving the 


formulation of the specification in the temporal logic in a specification formula in order to 
expand this formula and fill in the table and the stack of worked subformulas stored in a 
memory of the computer system and resulting fi-om the scanning of the computer system's log 
file; 

- a clause processing algorithm executed by the computer system, which makes it 
possible to resolve the Horn clauses using the information from the table and the stack of 
worked subformulas, this clause processing algorithm generating an output file or generating 
an action. 

Other characteristics and advantages of the present invention will emerge more clearly 
through the reading of the following description, given in reference to the attached drawings, 
in which: 

- Fig. 1 represents a schematic view of the hardware and software elements that make 
it possible to implement the method. 

- Fig. 2 represents the contents of the table, of the counters of the formulas or 
subformulas present in the negative parts of the clauses, and of the stack, and their evolution 
during the implementation of the method. 

Fig. 1 represents the elements required to implement the method according to the 
invention. The log file (1) is generally present in all the machines and can be the network log 
file when the machine is connected to a network, or a system log file, or any other file in 
which one wishes to verify a specification. A machine is understood to mean a computer 
comprising storage means, means for reading and for executing a program, and means for 
interacting with a user (for example screen, keyboard, mouse) and means for connecting to 
the network. This file communicates with an adapter (2), which is a software program for 
translating the information contained in the log file and expressed in the specific language of 
the machine into a high-level language understandable by an interpreter (3). The interpreter 
(3) also receives from a module (4) the formula of the specification to be verified, expressed 
in a temporal logic. This interpreter (3) performs the expansion of the formula into 
subformulas and the scanning of each record Ei (Annex 2) of the log file (1) in order to 
generate, by means of this expansion and this scanning, a resulting table and stack expressing 
Horn clauses stored in a memory (5). The concept of a Horn clause is well known to one 
skilled in the art, and is described for example in Goubault-Larrecq, Jean and Mackie, Ian, 
"Proof Theory and Automated Deduction," published by Kluwer, 1996). This table and this 


stack are used by a clause processing algorithm (6), which receives a start order from the 
interpreter (3) once the latter has filled in the table (5) containing a table of counters (7) and a 
stack (18), after having scanned all the records Ei of the file. This algorithm will look for the 
resolution of the specification for all of the records. When the completed scan of the record 
file (1) is detected, the clause processing algorithm generates either an output file or an action 
of the system or the machine. 

In an optimization of the method according to the invention, the phase for filling in 
the table (5) and the stack (18) and the phase for processing the clauses are performed 
concomitantly, so that the clause processing algorithm can generate the output file or the 
action of the system or the machine as soon as possible, and generally before the detection of 
the completed scan of the record file (1). 

To provide a better understanding of the method implemented, the latter will be 
explained with the help of an example whose formulas appear in an annex at the end of the 
specification. First of all, a log file is a set of records E = El, ... EN), as represented in Annex 
2. Each record Ei comprises a certain amount of information such as the date, the operation in 
question, the machine, a result, a subject, this list being non-limiting. 

Thus, El indicates that the machine user has tried to connect but has failed. 

To formulate a specification, as represented in Annex 1 , that can be detected or 
resolved, a specification formula in a temporal logic is used. This formula is described 
according to the following formula production in the grammar of the BNF format well 
known to one skilled in the art (Aho, Alfred V., Sethi, Ravi and UUman, Jeffrey D., 
Compilers: Principles, Techniques and Tools ^ Addison- Wesley, 1986): 

formula ::= atom 

I formula a formula 

I formula v formula 

I formula U formula 

I formula W formula 

atom ::= record 

I (formula) 
I atom 

I O atom, the next line exists and in the next line, the 
atom is true 
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I O atom, if the next line exists, then in the next 
Une, the atom is true 

1 0 atom, there exists a Une, either the current Hne or a 
subsequent line, the atom is true 
5 I atom, for all the lines starting with the current 

line, the atom is true 

The operators between formulas are the operator "a" for expressing a logical "AND", 
'V* for expressing a logical "OR", "U" for expressing the formulation "until", and "W" for 
expressing the formulation "waiting for", "O" for expressing the formulation "on the next 
10 line, which exists", "O" for expressing the formulation "on the next line, if it exists", "0" for 
expressing the formulation "on the current line or on a subsequent line", " " for expressing the 
formulation "on the current line and on every subsequent line." This notation is well known to 
one skilled in the art, (see for example Manna, Zohar and Pnueli, Amir, The Temporal Logic 
of Reactive and Concurrent Systems Specification^ Springer, 1992). Thus, the temporal 
15 formulation F = Fl W F2 allows for an easy formulation of a specification to be verified. 
4'^ Let us assume that the operator has entered, by means of a man-machine interface (4) 

fry;;. 

that allows the generation of a temporal formula, a temporal formula like the one appearing in 
P Annex 1. 

The interface (4) will translate this formula in Annex 1 into a temporal formula where 
S 20 F and H are atomic formulas in which F represents {op = "connection", result = "failed", etc.} 
Q and H represents {op = "connection", result = "success", etc. Furthermore, let us assume that 

the log file (1) contains the records El through E3 represented in Annex 2. 

First, the interpreter (3) performs an expansion of the formula for each record El, E2, 
E3, as represented in Annex 6, by generating subformulas for each record in order to deduce 
25 fi*om them Hom clauses that express the logical implications that exist between a formula and 
its subformulas, and the possibility of satisfying the atomic formulas, as represented in Annex 
6. Thus, for the record El, the formula is expanded into the subformula F to which the clause 
(J^ corresponds, into the subformula OH to which the clause (J^^{f^)^{J\) corresponds, etc. 
The interpreter (3) includes an optimization procedure that makes it possible to eliminate the 
30 redundancies and the unnecessary steps from the table of Annex 6, and after optimization, the 
interpreter will retain only the clauses generated that correspond to the table of Annex 7. To 
facilitate the understanding of the table of Annex 7 or the table of Annex 6, the notation OH 


5 


means: "There exists a line, either the current hne of the record or a subsequent line, in which 
the formula H is verified"; in order to verify whether F a OH is true in the record El , the pairs 
(formula, record), called configurations, are numbered; in the example, the pair (F a OH, El) 
is numbered (1). The interpreter (3) expands the formula F a OH in the record El into the 
formulas F and OH. The pair (F, El) is numbered fj^ the pair (OH, El) is numbered /3, and 
the interpreter generates the clause {^f^ a (J^^(J\)^ which expresses that if the configuration 
and the configuration /3 are verified, then the configuration /, is verified, which means that 
F is verified in the record El . O(0H) means : "the next line of the record exists and in the next 
line OH is true," which corresponds to the configuration for the first record. The formula 
HvO(OH) means "H is true or the next line of the record exists and in the next line, there 
exists a line, either the current line or a subsequent line, in which H is true," which 
corresponds to the configurations (/|) for the record El, (Jg) and (7,4) for the record E2 and 
(/19)? ifi^) (/2g) for the record E3. The set of hom clauses appearing in the right-hand part 
of the table of Annex 7 is stored in the table (5), in the counter (7) and in the stack (18) 
represented in Fig. 2, in the following way. The columns of the table (5) are indexed by the 
subscripts {f^), (/a), {f^X {fs\ (/a), (/s). (/n). (/12) of the formulas appearing in the negative 
part of the clause. Only the subscripts that implicate a conclusion are saved. The lines of the 
table (5) are indexed by the subscripts (/,), (J^)^ (fj) of the formulas appearing in the positive 
part of the clause. The negative part of the clause is the part located to the left of the 
implication arrow, which will hereinafter be called the implicating subformula(s). The 
positive part is to the right of the arrow and will be called the implicated formula. This 
representation is not limiting, and the representation in the form of a sparse matrix, the 
columns being represented by means of chained lists and the lines remaining implicit, is 
preferred. However, to provide a clear understanding of the invention, the latter will be 
explained using the notations of Fig. 2. To explain the notation of the table 7, the clause (f2) 
A (/a)— >(/i) means that if the configuration is verified and the configuration is verified, 
then the configuration /j is verified. The clause fy means that if the configuration f-, is 
verified, then the configuration is too. Furthermore, during the expansion of the formulas 
by the interpreter (3), the latter stored in a stack (18) the positive clauses corresponding to the 
formulas that can be satisfied. Thus, at the end of the expansion, the formulas /2 and /g are in 
the stack (18,), as shown in Fig. 2, and the table of the counters of negative literals in the 
clauses of the table is constituted by the information represented by the reference (7,) in this 



figure. In the resolution phase, the clause processing algorithm (6), when it is activated by the 
interpreter once the latter has filled in the tables (5, 7 and 18), after having examined the lines 
of the records in the log file, will begin by examining the top of the stack (18) and extracting 
from it the information that the configuration /«, in this case, is satisfied. The algorithm then 
5 examines, in the table (5), the clauses that have this configuration in the negative part, in this 
case the configuration Z^, and deduces fi-om them the counter that it must decrement. The 
counter {1^ represents the evolution in the counter (7|) of the counter that is associated with 
the formula represented in the positive part. The algorithm decrements the corresponding 
counter, in this case that of the configuration fi, and places at the top of the stack the value 

10 "7" of the configuration that is true, as shown in the box (1 82), which represents the evolution 
of the stack (18), while the column (1-^ represents the evolution of the counter. Next, the 
clause resolution algorithm will proceed by iteration, searching for the clauses that have the 
configuration f-j in the negative part in order to deduce from them that the configuration is 
yi true and decrement the counter corresponding to this line of configurations, as shown in the 

15 column (73). The algorithm (6) continues in this way until the stack (18) is empty or contains 

sr.*: 

i;!^ configurations already processed, and the only configuration /j that verifies the specification 

Hi is obtained in the stack (1 85). 

PI The expansion algorithm avoids unnecessarily replicating identical configurations, 

represented by their pointers, by establishing a hash table. The hash table data structure and 
^1 20 the associated algorithms are well known to one skilled in the art, (see for example Knuth, 
™J Donald Erwin, The Art of Computer Programming, Vol J, "Sorting and Searching," Addison- 

Wesley, Second Edition, 1998). 

Furthermore, it is also possible to achieve optimizations in the expansion of the 
formulas, in order to avoid several steps. Thus, instead of expanding the formula OF into 
25 FvO(OF), then into F and O(0F), and then into OF in the next state, it is expanded directly into 
F and into OF in the next state. Likewise, when there is a formula of the type FaG where 
either F or G can be evaluated as false in the current state, the expansion of the formula is 
halted. The method developed by the invention has an advantage over the known method of 
the prior art, in which a truth table like the one represented in Armex 4 is first established for 
30 each atomic formula, then secondly, truth tables (Annex 5) are established for the non-atomic 
subformulas using the truth table of Aimex 4. The model verification is then performed in two 
stages. First, it verifies whether the atomic formulas are true or false, which requires a 
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scanning of the states for each formula, then secondly, in order to establish the truth of the 
subformulas, it is necessary to see how each atomic formula behaves in each state, which 
amounts to performing several scans of the records. This means performing backward returns 
in the log file with all the ensuing read and set operations which, given the large size of a log 
file, can be very time-consuming. The method developed by the invention is much more high- 
performance and economical, in terms of size and the memory required to store the 
intermediate states. 

To provide a better understanding of the algorithm, we will describe it briefly, then 
present it formally. 

The specification file, 7%, is considered to be a finite set of formulas whose syntax 
and semantics are defined above. Let us use the notation F for the set of all the formulas 
whose syntax and semantics are defined above, and (7?;, R\j^\)(y/ith N equal to the number 
of records in the file) for the log files. Log files are files that record everything that happens 
in a system (for example, a file that traces the users' connections to and disconnections from 
the machines). A record is a fiinction R with a finite domain and codomain from E* to E*, or 
the set of character strings 

R: S* -> 

Let us use the notations dom(R) and codom(R)^ respectively, for the domain of R and 
the codomain of R, 

Example 1 (record) Let us consider the record 7? of a log file: 
Date = 02:27:2000, operation = connection, machine = papillon, 

result = success, subject = Machine 
we then have: dom(R) = {date, operation, machine, result, subject} 
where dom(R) is the domain and codom is the codomain 
codom(R) = {02:27:2000, connection, papillon, success. Machine}, and 
R: S* S* 
date^ 02:27:2000 
operation-> connection 
machine— > papillon 
result— > success 
subject-^ Machine 

A log file is therefore a (finite) set of records /?y, R\!^\, 
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Let ''Current'' and "Nexf be sets of formula representations (in the remainder of the 
description, "formula" will be used to mean "formula representation"); Current is the set of 
formulas to be examined in the current state and Next is the set of formulas that must be 
examined in the next state. 

In each state, the set "Current is the union of the set ''Next'' and the formulas 
associated with the current state. That is what step 2) of the algorithm says. 

The current state is represented by the integer /;!</< I N | . 

The "log" file is scanned in one pass, and during this scan, in each state, i.e. in each 
record of the file, the formulas of the set Current that are verified are revealed, and those that 
contain future operators are added to the set "Next" so they can be examined in the next state. 
That is what the "Expand' procedure in step 3) of the algorithm does. This procedure extracts 
the subformulas from each formula recursively, stores the logical implications that concern 
them in the form of Hom clauses in a matrix M (for example, for a formula F = Fj a F2, we 
have the clauses F, F and Fj — > F), and for those that are atomic, if they are verified in the 
current state (which is what the "match" procedure appearing in "Expand" looks for), it stores 
them in a stack (Stack), which is a stack of formula representations. Once all the formulas 
have been expanded in the current state, those that are resolvable are resolved with the help of 
the matrix and the stack (this is what the "resolve matrix" procedure in step 4) of the 
algorithm does). Thus, as a result of the atomic formulas that have been resolved and the 
clauses, all the formulas that are verified are stored in the file "ResForm" (which is a set of 
formula representations). 

These steps are iterated until the end of the "log" file (as seen in step 4) of the 
algorithm). Finally, when the entire log file has been scanned, the "Satis" procedure of step 5) 
compares the formulas of the file ResForm, which are all formulas verified in a certain state 
but which are subformulas of formulas of the specification file, to the formulas of the 
specification file, in order to see which ones are verified, and in which state(s). 

Here is the algorithm itself: 
1) / = 0; 

Current:= 0; 

Next:= 0; 

ResForm:= 0; 

Stack = stack_empty; 


M=(); 

2) Current:={Repr(F, i)/F e F,} U Next; 

where Repr(F, i) is a stored representation of F in the / state 
Next- 0; 

3) if Current ^ 0 then: 
let / G Current, 
Current = Current] { f} ; 
Expand(f)\ 

4) resolve _matrix\ 

if/< InI 

then /:= / + 1 ; 
go to 2): 
otherwise go to 5); 

5) Satis; 

We will now define the various procedures used in the algorithm. 
^^Expand(fy^ procedure, where / is a formula representation. 
For greater clarity, this procedure will be presented with the help of a table whose 
meaning will now be explained: 

- the ''Formula'' column is exactly: form (f), i.e., the formula represented by /, 

- the "Current" (or respectively, "Next") column designates all the formula 
representations that have been added to the "Current" (or respectively, "Next") set, 

- the "Clause" column designates the clauses that are stored in the matrix with the 
insert_clause procedure described below; 

- the formula representations added to the "Current" set are in turn expanded 
recursively; 

- the atomic formulas and the formulas with the form --Fy, where Fj is an atomic 
formula, are processed separately: if the atomic formula corresponds to the current record 
(match I record) (the "match" procedure is defined below), then this formula is verified in the 
/ state; if the atomic formula does not match the current record, then ^F^ is verified in the / 
state. More formally: 

If form(f) is an atomic formula, 
\imatch(f) = TK\]E 
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then Stack = Stack(StacK f) \ 
If form(f) has the form -"F/, Fy being an atomic formula, 
lei f, = Repr(F,. i){ 
if matchff J ^ FALSE 
then Stack = StackfStack, f); 


Formula 

Current 

Next 



/, = ReprfFj, i) 
f-y = Repr(Fj, i) 



F,VF, 

/, = Repr(F„ i) 
/, = Repr(F„ i) 



OF, 


/, = Repr(F„ i + 1) 

f^^f 

OF, 


f, = ReorfF, i + 1) 
si / 5t 1 n1 (*) 

J 1 ^ J 

OF 



f,~^f 

J 2 ^ J 

'I 

f, — RenrfF. i) 


J I /\ J 2 ^ J 

F, UFy 

/*, = ReprfF, a 0(F, f/ 
A ~ Rsp''(F2, i) 


f 

J \ J 
/2-> / 

F,WF, 

/, = y?e/?/-rF„ i) 
f, = Repr(F,UF^. i) 


/,->/ 
fl-^f 


/, = Repr(^F2 v 


fx^f 


/, = Repr(--F2 a ^^j, 




/, = Repr(F2, i) 


fx^J 

-(OF J 

/, = Repr(0(rF2. i) 



-(OF J 

f,=Repr(0(^F2, i) 


fy^f 

-(OF J 

/, = Repr((--F2, i) 


fx^f 

-(F2) 

f, = Repr(0i-^F2. i) 



-(F,UF^ 

f,=Repr((^F^O 
f, = Repr(-F,Ui--F2, a. 


fs^J 
fi^J 

-(F.WFJ 

F, = Repr((-F^ U(^F2, 




*: otherwise, i.e. if / = | N | , 
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/, = Repr(F„ i) 

Stack = Stack(Stack, /,); 

^^match(fy^ procedure, where / is a formula representation 

In the case of formQ: 

- if it has the form {id, = t,, id„ = t^,, ...}, then: 

- if Vj, l<j<n, idj G Dom(R^), and match- term 
(R/(idy), \j\ f) 

- then TRUE 

- otherwise FALSE 

- if it has the form {id, = t,, id„ = t^, ...}, then: 

- if n = I domRi) | and j, l<j<n, idj g Dom(R^), 
and match-term (R/(id/), t/', f) 

- then TRUE 

- otherwise FALSE 

- "match-term" procedure (w, t, f) where w, t g E* U V and / is a formula 

representation: 
in the case of t: 

- if t is a regex: 

-if Reg (w, t) 

- then TRUE 

- otherwise FALSE 

- if t is a variable x: 

Notation: p(x) is a partial function of the set of variables V to the set of character 
Z* 

- if p(x) is defined 

- if p(x) = w 

- then TRUE 

- otherwise FALSE 

- if p(x) is not defined, then 
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Notation: E is the environment constituted by the pairs whose first component is taken 
fi-om the set of variables and whose second component is taken from the set of character 
strings 

E: = Eu {(x, w)}; 

- TRUE; 

Insert-clause procedure (H), where H is a Hom clause having one or two formula 
representations in the negative part: 

Notation: If M is a matrix m x n, m, n e N, let m^ j be the element of the i^ line 
indexed by /, and likewise m^^ and m^^, ^2 

In the case of H: 

- if H has the form /, -> /, then 

- if there already exists a column of M indicated by /j 

- then add a line indexed by / with mf ^ = 1 ; 

- otherwise, add a column indexed by / and a line indexed by with m^^, = 

1; 

- if H has the form /j ^ then: 

- if neither /, nor /2 is an index of any column of M 

- then add 2 columns indexed by /i and /2 and a line indexed by / with 

- if only one of the /j, i = 1,2 is not an index of a column of m, then: 

- add a column indexed by /; and a line indexed by / with m^^ = m^jj = 2, 
where j g {l,2}\{i} 

- if /, and /2 are indexes of columns of M, then: 

- add a line indexed by / with tn^ji = ^f,f2 ^ 2 

resolve-matrix procedure 

- if Stack = stack-empty, then nothing; 

- otherwise, let /:= pop(Stack); such that m,j is the element that exists then: 

- Vj such that exists, then: m^ := mjj-l 

- if m^j = 0, then; 
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- let /, be the index of the Hne 111^ ^^ 

- if /, Res-Form, then: 

- Stack:= stack(Stack, /,) 

- Res-form:=Res-Fomi U {/,} 

- dele (nii^); 

- if the i^ line, delete it; if the column indexed by / is empty, delete it 

Satis: 

If Stack ^ stack-empty then: 

- let /, = pop(Stack); 

- if /, e F^, then fomi(/) is verified in the state state(/) 

It should be clear to those skilled in the art that the present invention allows 
embodiments in many other specific forms w^ithout going outside the field of application of 
the invention as claimed. Consequently, the present embodiments should be considered as 
examples, but can be modified in the field defined by the scope of the attached claims. 
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ANNEX 


Annex 1 

{op = « connection », result = « failed . . } 

and later {op = « connection », result = « success »,...} 

Annex 2 

El : {op = « connection », result = « failed » , subject = « machine »} 
E2 : {op = « connection », result = « success », subject = « machine », 
date = « 09: 14:99»} 

E3 : {op = « exec », result = « success », object = « emacs », mode = « tex »^ 
subject = « machine »} 

Annex 3 

F A 0 H where F and H are atomic formulas for detecting events expressed in 
temporal logic from atomic formulas. 

El : {F} 
E2 : {H} 
E3 : {G} 

Annex 4 


STATES 

F 

H 

El 

1 

0 

R2 

0 

1 

R3 

0 

0 


Truth tables of the atomic formulas 
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Annex 5 


STATES 

OH 

F AOH 

El 

1 

1 

E2 

1 

0 

E3 

0 

0 


Truth tables of the non-atomic formulas 


Annex 7 


STATES 

Formulas et subformulas 

Clauses generated 

El 

FAO H 


(/,) 



(/,): 

F 

Ui) 

(/:) 



OH 


(/2)A(/3) ^(/.) 


(/3) 

H 

Ud 

C/^) ^FALSE 

E2 

FAO H 


Ud 



(/a) 

OH 

Ui) 

(/7)^(/3) 



H 

C/s) 

(A) 


(/a): 

F 

Us) 

a6)->(/7) 





(/6)->FALSE 

E3 

FAO H 


(/.o) 




OH 

(/,.) 



(/..) : 

H 

(/>2) 

(Jn) ->FALSE 


(/.o) : 

F 

Uu) 

(/,,) ^FALSE 
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Annex 6 


STATES 


El 


E2 


hi 
O 


Foimulas et subfonnulas 


FAO H 
(/.): 

(/,): 
(/.): 


F 
OH 
H V O (0 H) 
H 


0( OH) 


(/,) 
(/a) 

(/4) 


FAO H 

(/s): 


C/t): 
(/u): 


(OH) 
HVO(OH) 
H 

0(OH) 


(OH) 


H VO(OH) 


0(OH) 


(fi) 
(/») 

(/») 

(/>o) 

(/..) 

(/.2) 

(/u) 


(/.*) 


FAO H 

b'hl 
(/,.): 
(/,»): 


(/.6) 
(/22) 


OH 

i HVO(0H) 


0(OH) 
(OH) 
H 


H VO(0H 


(/2S) 


0(0 H) 

F 
OH 
H V O (0 H) 
H 


0( OH) 


(/it) 
C/i.) 

(/>9) 

(/20) 

(/22) 

(/as/ 

(/24) 


(/25) 

(/26) 
(/27) 
(/28) 
(f29) 


(/30) 


Clauses generated 


(/2) 

(/:) A (/3) ->(/,) 

a5)^c/4) 

C/s) -»FALSE 

(/6)^(/4) 


(/8)->(/6) 

a*) ->(/») 

(/.o) ->(/») 
(/>o) 

(/,.)-> c/9) 

(/,2)-> FALSE 

(/.2)A(/.3)-*(/7) 

a,4)->(/>3) 
a,5)->(/.4) 

(/,5) 
(/.6)^(/,4) 


(/>8)^n) 
(/.9)->(/l8) 
(/20)-*(/l9) 

(/,o) ^>FALSE 

(/2>)->(/l9) 
(/22)^(/.6) 
(/23)-^(/22) 
(/24)->(/2,) 

^ FALSE 

(fe:»-^) 

(y^jy/->FALSE 
'^Jis) ^FALSE 

(/26)A(/27)->(/.7) 

(/28)^(/27) 

(/29)^>(/28) 

(/2,) ->FALSE 
(/30) ^FALSE 
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